Privacy Policy
Last updated: June 28, 2026
1. Introduction
PRHandshake ("we", "our", or "the App") is a GitHub App that helps repository maintainers evaluate pull requests through deterministic, auditable verification of contributor metadata, submission evidence, repository policy compliance, and review readiness.
PRHandshake analyzes GitHub metadata and repository configuration made available through the GitHub API to evaluate pull request submissions against repository policies and contribution requirements. PRHandshake evaluates existing GitHub Check Run results and repository configuration as part of its assessment.
PRHandshake provides maintainers with structured verification results and compliance information to support the pull request review process. Final review and merge decisions remain the responsibility of repository maintainers.
2. Information We Access
When installed on a GitHub repository or organization, PRHandshake may access the information necessary to provide its pull request verification service, including:
- Pull request metadata — titles, descriptions, authors, labels, changed files, additions, deletions, and related metadata.
- Repository metadata — repository name, owner, default branch, and repository settings relevant to pull request evaluation.
- Public contributor profile information — account creation date, public repository count, and follower count.
- Comments — issue comments, pull request comments, and review comments used to process authorized maintainer commands and repository workflows.
- GitHub Checks and workflow status — to verify required status checks and repository policies.
- Repository configuration files — such as CONTRIBUTING.md, pull request templates, and other repository configuration files relevant to repository contribution requirements.
PRHandshake requests only the GitHub permissions necessary to perform these functions.
3. How We Use Information
Information accessed by PRHandshake is used solely to provide the service. This includes:
- Evaluating pull request readiness.
- Verifying repository policies and contribution requirements.
- Generating GitHub Check Runs, reports, and related notifications.
- Processing authorized maintainer commands.
- Maintaining the reliability, security, and integrity of the service.
PRHandshake does not use repository or user data for advertising, marketing, profiling, or training machine learning models.
4. Data Retention
PRHandshake processes GitHub webhook events as they are received. Webhook payloads are retained only as long as necessary to complete processing. Operational logs may be retained for up to 30 days for troubleshooting, security, and service reliability before being automatically deleted.
5. Data Sharing
PRHandshake does not sell, rent, or share repository or user data with third parties.
Analysis results are returned directly to GitHub through GitHub Check Runs and are visible only to users with the appropriate repository permissions.
6. GitHub Permissions
PRHandshake requests only the minimum GitHub permissions necessary to perform its required functionality. Current permissions include:
- Metadata — Read
- Pull Requests — Read
- Issues — Read
- Contents — Read
- Checks — Read and Write
7. Security
All communication between GitHub and PRHandshake is encrypted using HTTPS. GitHub webhook deliveries are authenticated using HMAC-SHA256 signature verification before processing.
8. Uninstalling
Repository owners and organization administrators may uninstall PRHandshake at any time through GitHub. Upon uninstallation, GitHub immediately revokes the App's access to the repository.
9. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to PRHandshake or applicable legal and platform requirements. When material changes are made, the Last updated date at the top of this document will be revised.
10. Contact
Questions regarding this Privacy Policy may be sent to hello@prhandshake.dev.